1. Field of the Invention
This invention relates generally to nuclear reactor protection systems and more particularly to methods and apparatus which directly, in real time, measure the power generated within the core of a nuclear reactor at a large number of radially and axially distributed, spaced locations within the core and use that information, together with sensor outputs determinative of the heat removed from the core, to determine when reactor thermal protection should be initiated.
2. Background Information
The performance of a nuclear reactor, like that of many other energy conversion devices, is limited by the temperature which component materials will tolerate without failure. In the case of a nuclear reactor with a core comprising an assemblage of fuel assemblies, which in turn consist of an array of fuel rods or pins, the upper limit of temperature is determined by the fuel rod or fuel pin cladding materials employed. In order to adequately protect the reactor core against excessive temperatures, it is necessary to examine the temperature of the "hottest" fuel pin or the "hottest" coolant channel between adjacent fuel pins in the core, since damage will most likely first occur in the "hottest" fuel pin. Thus, the "hottest" pin or channel becomes the limiting factor for safe reactor core operation.
As is well known, heat is generated in a reactor by a fission process in the fuel material. The fission process, however, produces not only heat but radioactive isotopes which are potentially harmful and which must be prevented from escaping to the environment. To this end, the fuel is clad with a material which retains the fission products. In order to prevent clad overheating and in the interest of precluding release of fission products which would occur on clad damage or failure, coolant is circulated through the reactor core. Heat transferred to the circulating coolant from the fuel elements is extracted in the form of useable energy downstream of the reactor core in a steam generator. Thus, for example, in a pressurized water reactor system the water flowing through the core is kept under pressure and is pumped to the tube side of a steam generator where its heat is transferred to water on the shell side of the steam generator. The water on the shell side is under lower pressure and thus, the thermal energy transferred causes the secondary water to boil. The steam so generated is employed to drive a turbine which in turn motors a generator for the production of electricity.
As the coolant circulates through the reactor core, heat will be transferred to it either through subcooled convection, often referred to as film conduction, or through nucleate boiling. Nucleate boiling occurs at higher levels of heat flux and is the preferred mode of heat removal since it permits more energy to be transferred to the coolant, thereby permitting the reactor to operate at higher levels of efficiency. Nucleate boiling is characterized by the formation of steam bubbles at nucleation sites on the heat transfer surfaces. These bubbles break away from the surface and are carried into the main coolant stream. If the bulk coolant enthalpy is below saturation, the steam bubbles collapse with no net vapor formation in the channel. This phenomenon is called subcooled boiling or local boiling. If the bulk fluid enthalpy is at or above the enthalpy of saturated liquid, the steam bubbles do not collapse and the coolant is said to be in bulk boiling.
If the heat flux is increased to a sufficiently high value, the bubbles formed on the heat transfer surface during nucleate boiling are formed at such a high rate that they cannot be carried away as rapidly as they are generated. The bubbles then tend to coalesce on the heat transfer surface and form a vapor blanket or film. This film imposes a high resistance to heat transfer and the temperature drop across the film can become very large even though there is no further increase in heat flux. The transition from nucleate boiling to film boiling is called "departure from nuclear boiling" (DNB).
Another condition which requires protective action is the occurrence of a high local power density in one of the fuel pins. An excessive local power density initiates centerline fuel melting which may lead to a breach of the fuel clad integrity. In addition, a condition of excessive local power density is unacceptable in the event of a loss of coolant accident since excessive local power density would cause the clad temperature to exceed allowable limits if the coolant were lost. As the result of analysis of loss of coolant accidents, values are established by the reactor designers for the maximum allowable local power densities at the inception of a loss of coolant accident, such that the criteria for acceptable consequences are met. The maximum local power density limit is generally specified as a linear power density (LPD) limit with units of watts per centimeter.
A third condition which acts as an operating limit is the licensed power at which the particular reactor is permitted to run. All three of these limiting conditions for operation must be monitored in order to make reactor operations safe. Since clad damage is likely to occur because of the decrease in heat transfer coefficient and the accompanying high clad temperatures which may result when DNB occurs, or because of an excessive local power density, the onset of these conditions must be sensed or predicted and corrective action in the form of a reduction in fission rate promptly instituted. One way of monitoring DNB in the reactor is to generate an index or correlation which indicates the reactors condition with respect to the probability of the occurrence of DNB. This correlation is called the Departure from Nucleus Boiling Ratio "DNBR". Both the DNBR and LPD limits are indicative of the proximity of operation to the appropriate design limits.
In a complex process, such as a nuclear power plant, numerous sensors are provided to measure various physical conditions in the process, such as for example, pressures, temperatures, flows, levels, radiation, and the state of various components, such as, the position of valves, control rods and whether a pump is operating or not. These measurements are generally used to perform three different functions: process control, surveillance and protection. Process control involves automatic or semiautomatic regulation of process conditions to achieve the desired result. Surveillance encompasses monitoring of process conditions to determine that the desired results are being achieved. Protection is concerned with automatic response to abnormal conditions in the process to prevent the operating conditions from exceeding predetermined design limits and to take steps to mitigate the adverse affects of operation outside of the design limits. In the case of a nuclear power plant in particular, the protection function is the most demanding of the three. In order to assure reliability of protection systems redundant sets of critical sensors are provided. In order to improve the availability of the plant, correlation between the signals produced by the redundant sensors is made a prerequisite to initiation of the response to thereby reduce the probability of spurious interruption of normal operations. For instance, typically four redundant sets of sensors are provided, and an indication by at least two out of the four sensors is required to actuate the emergency or safety system.
Some of the critical process conditions can be measured directly, such as pressurizer pressure in the case of a pressurized water reactor. Others are calculated from measured parameters, such as the DNBR, as previously mentioned. In either case the existing condition is compared with a preselected limiting value, and if the limit is exceeded, a digital signal is generated. These digital signals will be referred to as protection system actuation signals and include trip signals which are used to activate a system which shuts down or "trips" the reactor and engineered safeguard actuation signals which are used to initiate the operation of other plant emergency systems, as is well known in the art. Since more than one such actuation signal is required to initiate the response, they are referred to as "partial trips" or "partial engineered safeguard actuation signals". In the typical prior art system, the sensor signals are grouped for processing in channel sets with each channel set including one sensor signal from each set of redundant sensor signals. As previously mentioned, a common arrangement is to provide four redundant sensors for most parameters, that are arranged in four channel sets for processing. In prior art systems, each channel set includes a number of processing circuits which convert the sensor signals to the appropriate range, calculate the desired parameter from the measured values when necessary, compare the resultant signal with a selected limit value and generate a protection system actuation signal when the limit is exceeded.
In the typical prior art protection system, the four partial trip and partial engineered safeguard actuation signals from each channel set for each parameter are applied to two redundant logic circuits which each perform the selected voting logic, such as two out of four as previously mentioned, on the partial protection system actuation signals. If two out of four of the corresponding partial actuation signals in either of the two logic circuits are initiated, appropriate emergency and safety control systems are actuated.
In making the calculations that determine the core protection functions that are to be compared against the design limits or set points, there are two general regimes that are considered. The first is a calculation of the amount of heat removed from the core which is determined from the flow rate, the temperature of the coolant and the pressure of the primary system. Both flow rate and the pressure can be reliably monitored. However, some prior art devices monitor the core exit temperature for this calculation, because of its applicability to the power calculation as well. However, the temperature of the coolant exiting the core may be stratified and is therefore subject to increased uncertainty due to the variability of the sensor indication. The coolant flowing at the inlet to the reactor vessel is well mixed and thus much more reliable for this calculation. The second regime establishes the three-dimensional power distribution within the core. Prior art systems have relied upon the signals derived from out-of-reactor detectors positioned around the periphery of the reactor vessel to synthesize the in-core power distribution from calculational models and delayed in-core detector responses which were used to identify axial tilts and gross power distribution. As a result, extra margins had to be built into the set points to factor in the uncertainties in these models and the additional sensor inputs, e.g., control rod position and core exit temperature; both subject to large uncertainties in the evaluation of power distributions. An example of such a prior art system is illustration in U.S. Pat. No. 4,330,367 issued May 18, 1982.
Accordingly, there is need for an improved protection system that can operate at reduced set point margins to improve the efficiency and reliability of reactor operation. It is a further object of this invention to provide such a system that relies upon a direct, real time measurement of core power at a plurality of axially and radially spaced locations throughout the core. It is a further object to accomplish that objective with reactor sensor inputs that are all reliable and exhibit small uncertainties in the determination of local reactor power generation.